Bugs and Fixes: Leaky Windows--Keep the Hackers Out

Imagine finding out that you had left your front door unlocked for half a decade--and didn't know it. Sure, it's an exaggeration; but for Windows 98 users, a certain security hole has been lurking for that long. In fact, this newly discovered flaw affects all versions of Windows from the first edition of Windows 98 (as well as Windows NT) through Windows XP. Microsoft also discovered a separate flaw involving Windows Me PCs.

Why it took Microsoft five years to catch such a widespread problem is beyond me, especially given the company's ballyhooed "Secure Windows Initiative"--a program aimed at improving security measures in all its products.

The first hole involves the scripting engine found in all Windows flavors. A miscreant could decoy you with a booby-trapped HTML e-mail message, or lure you into clicking a contaminated link on a Web page, and exploit a weakness in the scripting engine. Once you click, you run the villain's little script, and--shazam!--you've just given the scoundrel all the capabilities that you have on your system.

Visit Microsoft's TechNet to grab the fix. Your PC is already protected from an e-mail attack exploiting this flaw if you use either Outlook Express 6 or Outlook 2002 in its default configuration, or if you use Outlook 98 or Outlook 2000 and have installed the Outlook E-mail Security Update.

Another option (albeit an extreme one): You could block potential attacks by disabling active scripting in IE--but then portions of legitimate Web sites that use scripting won't function correctly. To disable scripting within IE, select Tools, Internet Options, choose the Security tab, and select the Custom Level button. Scroll down to the settings for Active Scripting and for Scripting of Java Applets, and click the Disable radio buttons.

The second Windows hole, which affects Me's Help feature, could let a sneaky cracker take over your PC--in some cases by just sending you an HTML-formatted e-mail.

Most of the same caveats apply for this Windows Me problem as for the scripting bug. Though you can't prevent an attack simply by resetting IE's security settings, using Outlook Express 6 or Outlook 2002 with the default configurations will protect your PC. And if you use Outlook 98 or 2002 with the Outlook E-mail Security Update, you're in good shape too.

If you don't fall into either of these camps, however, your PC can be attacked through a tainted e-mail message. Better to be safe than insouciant; download the patch.